Select Two (Multi-Select) Questions

Deploy a DaemonSet Defender directly on the GitLab SaaS shared runner worker nodes.

Why it fails: GitLab.com SaaS runners are GitLab-managed and inaccessible to customers, so a Defender DaemonSet cannot be deployed onto them. Self-hosted runners on your own Kubernetes cluster would accept a Defender DaemonSet, which is why the option tempts; SaaS pipelines instead require a scanner container or CLI invocation in the job.

Attach an AWS Network Security Group to the GitLab runner virtual machine.

Why it fails: A Network Security Group filters traffic at the AWS network layer and has no role in Prisma Cloud Compute scanning; integration uses the scanner image and CI/CD variables. It is tempting because runners need network reachability, but NSGs govern infrastructure traffic, not pipeline scanning configuration.

Enable AWS GuardDuty threat detection on the GitLab repository S3 bucket.

Why it fails: GuardDuty monitors AWS account activity for threats; it cannot execute or report Prisma Cloud Compute image scans inside GitLab jobs. It is tempting because GuardDuty is AWS's native threat-detection service, and it would be the right choice when protecting EC2, EKS or S3 workloads from compromise rather than scanning pipeline artefacts.

The credit card number density found inside the container layers

Why it fails: Credit card number density is a data-loss-prevention concern, not a vulnerability threshold criterion; Prisma Cloud Compute rules use severity, CVSS, package type and fix status. It is tempting because Prisma Cloud does detect sensitive data in images, but that belongs to DLP policies, not vulnerability thresholds.

The geographic region where the container registry is hosted

Why it fails: Registry hosting region is not a vulnerability attribute; Prisma Cloud Compute thresholds use severity, CVSS score, package type and fix status. It is tempting because geography matters for data residency and compliance scoping, but vulnerability rules evaluate the image's packages and findings, not where the registry is hosted.

An unencrypted plaintext list of all employee social security numbers

Why it fails: A trust policy is a JSON document specifying principals and sts:AssumeRole conditions; embedding social security numbers serves no authorisation function and breaches data-protection obligations. It is tempting because identity data appears access-related, but the trust policy mechanism is principal ARN matching, not credential storage.

A rule opening all TCP ports from 0.0.0.0/0

Why it fails: A trust policy defines which principals may assume the role via sts:AssumeRole, so a 0.0.0.0/0 TCP rule belongs in a security group, not an IAM policy document. It is tempting because broad ingress rules are a familiar way to permit connectivity, but they grant network access, never role assumption.

A requirement that all users must connect via dial-up modems

Why it fails: Trust policies contain JSON principal, action and condition statements; dial-up modem requirements are a network transport control and cannot be expressed there. It is tempting because restricting access paths feels security-relevant, yet the trust policy's mechanism is principal-based delegation, not connection media.

Kernel patch level compliance reports for Jira database nodes.

Why it fails: Kernel patch level compliance reports are host-hardening telemetry, not integration credentials, so they play no part in connecting Prisma Cloud to Jira. The distractor tempts because Prisma Cloud does surface kernel and patch compliance data, but that belongs in vulnerability and compliance dashboards, not in the ticketing webhook configuration.

Local root SSH private key for the Jira server operating system.

Why it fails: Jira integration uses API tokens or OAuth credentials over HTTPS; a root SSH key for the Jira host operating system is never requested and would grant excessive access. It is tempting because SSH keys authenticate to servers, but Prisma Cloud needs application-level API access, not OS login.

Static analysis of container Dockerfiles during CI/CD builds.

Why it fails: Dockerfile analysis is performed by twistcli in CI/CD pipelines, not WAAS.

Kernel-level system call filtering and container namespace isolation.

Why it fails: System call filtering is handled by container runtime defense, not WAAS.

Kubernetes node autoscaling and resource quota management.

Why it fails: Node management is handled by Kubernetes control plane components.

A local Microsoft Excel spreadsheet stored on an administrator's desktop.

Why it fails: A desktop spreadsheet provides no API, so Prisma Cloud CSPM cannot onboard or poll it as a cloud account; posture management requires provider API credentials. It tempts because spreadsheets genuinely serve manual asset inventories or compliance evidence tracking, but never automated native onboarding.

A home Wi-Fi router running consumer firmware.

Why it fails: Prisma Cloud CSPM onboards cloud accounts and SaaS platforms through provider APIs; consumer router firmware exposes no such API or account model. It would be relevant to IoT device posture tooling, not cloud security posture management onboarding.

A standalone personal computer running Windows 10 Home edition.

Why it fails: Prisma Cloud CSPM discovers cloud resources via provider APIs; a standalone Windows 10 Home endpoint has no cloud account to onboard. It would be the correct target for an endpoint protection or vulnerability management product, not CSPM account onboarding.

Manufacturing hardware firewall appliances for branch offices.

Why it fails: Prisma Cloud CSPM is agentless software that scans cloud configurations for misconfigurations and compliance drift; it ships no branch hardware. It is tempting because hardware firewalls are a legitimate network-security control, but they belong to on-premises perimeter deployments, not a cloud posture-management platform.

Acting as a primary DNS nameserver provider for enterprise domains.

Why it fails: Prisma Cloud CSPM queries cloud provider APIs to assess resource configurations; it neither hosts authoritative zones nor answers DNS queries. It is tempting because DNS security is a genuine cloud concern, but that is handled by dedicated DNS services or DNS security products, not by a posture-management tool.

Providing physical security guards and biometric badge access for data center server rooms.

Why it fails: Prisma Cloud CSPM operates entirely through cloud APIs and agents, offering no physical guarding or biometric access control. It is tempting because data-centre physical security is a real domain, but it is delivered by facilities and access-control systems, not by a cloud-native security posture product.

Enabling AWS CloudTrail integration in all active operational regions.

Why it fails: CloudTrail integration supplies the audit log data Prisma Cloud analyses; it is a data source, not a finding about an identity. Enabling it is correct when the goal is activity visibility across regions, whereas the question asks which identity attributes are flagged as risky.

Using standard lowercase naming conventions for custom IAM roles.

Why it fails: Lowercase naming of custom IAM roles is a cosmetic convention with no bearing on privilege; Prisma Cloud flags identities holding excessive permissions, wildcard actions or unused credentials. Naming standards are governance hygiene, relevant to tagging or naming-policy compliance checks rather than identity risk findings.

Tagging cloud resources with owner email addresses for billing attribution.

Why it fails: Owner email tags support cost allocation and accountability, not identity risk detection. Prisma Cloud's identity findings concern permissions and credential behaviour, such as over-privileged roles or dormant access keys. Tagging resources is the right control when the requirement is chargeback or ownership reporting.

They automatically disable all VPC security group rules

Why it fails: IAM policy permissions cannot alter VPC security group rules; that requires ec2:AuthorizeSecurityGroupIngress or similar EC2 actions. The option is tempting because least-privilege reviews do flag overly broad network permissions, but here the escalation arises from attaching inline policies to users, granting them arbitrary permissions.

They force the rotation of the AWS root password

Why it fails: Root password rotation is an account-security hygiene action unrelated to IAM policy manipulation, so it neither grants nor escalates permissions. It is tempting because root credentials are highly sensitive, and rotating them would be the right control when hardening the root account, but it does not explain why those IAM permissions enable privilege escalation.

Configure Prisma Cloud to automatically delete cloud accounts that contain inactive IAM users.

Why it fails: Deleting accounts removes the identity records needed for investigation and remediation, and Prisma Cloud does not perform account deletion; it detects and reports risky IAM configurations. It is tempting because removing dormant identities reduces attack surface, and would be correct if the task were manual deprovisioning after an approved review.

Disable all logging services like CloudTrail and Cloud Audit Logs to prevent log tampering by attackers.

Why it fails: Disabling CloudTrail and Cloud Audit Logs destroys the audit evidence required to detect and investigate identity-based attacks, directly undermining the objective. It is tempting because attackers do tamper with logs, so protecting them matters, but the correct practice is centralising logs to immutable storage, not switching logging off.

Modifying AWS VPC subnet CIDR blocks and route tables.

Why it fails: VPC subnet CIDR blocks and route tables are AWS networking constructs, changed in the AWS console or via CloudFormation, not Prisma Cloud. Access Control manages Prisma Cloud user roles and permissions; network topology configuration sits under cloud account onboarding and network security policies.

Configuring automated AWS S3 bucket encryption keys.

Why it fails: Prisma Cloud Access Control governs user roles, permissions and SSO mappings, not cloud workload configuration. S3 encryption keys are set through AWS KMS policies or Prisma Cloud's data-security posture policies, so this belongs to compliance and data protection, not identity access management.

Updating the global firewall rules of Prisma Cloud SaaS load balancers.

Why it fails: Prisma Cloud SaaS load balancer firewall rules are managed by Palo Alto Networks internally, not exposed to tenant administrators. Access Control configures tenant-level roles, SSO and permission groups; infrastructure firewall management falls outside the customer's administrative scope entirely.

Disabling AWS GuardDuty in the account

Why it fails: GuardDuty is a threat-detection service that analyses CloudTrail, VPC flow logs and DNS activity; disabling it removes monitoring and does not narrow any IAM policy. It is tempting as a way to silence findings, but remediation requires editing the policy to remove wildcard actions or resources.

Deleting the underlying virtual private cloud (VPC) network

Why it fails: Deleting the VPC removes network resources, not the IAM policy granting excessive permissions; the identity keeps its broad access elsewhere. It tempts as containment during an active breach, yet policy remediation means scoping or detaching the offending statements.

Upgrading the cloud provider support tier to Enterprise

Why it fails: Support tier changes billing and response entitlements, not policy contents; the permissive statements remain attached to identities. It tempts because Enterprise tiers add security posture features, but remediation requires editing or replacing the policy itself, which any tier permits.

Sending Morse code signals to the cloud provider API endpoint

Why it fails: Morse code cannot be transmitted to or parsed by a cloud provider's REST API endpoint, so no IAM configuration data returns. Standard methods are the Prisma Cloud API and RQL queries in the console; Morse suits telegraphy, not cloud security posture management.

Dialing a telephone number to hear an automated audio reading of IAM logs

Why it fails: Prisma Cloud exposes IAM configuration through its REST API, CLI (prisma-cloud), and the console's Investigate/Compliance queries; a telephone audio service is not a query interface. It is tempting because automated voice notification exists for alerting, which would suit paging on-call staff about findings, not retrieving configuration data.

Using a standard television remote control to scan cloud assets

Why it fails: A television remote control cannot authenticate to or query Prisma Cloud APIs, so it retrieves no IAM configuration data. Standard methods are the Prisma Cloud API and RQL queries in the console; a remote suits changing channels, not cloud security posture management.

Root-level administrative write access on all AWS billing portals.

Why it fails: Prisma Cloud onboarding uses a read-only cross-account IAM role plus an external ID, so root write access on billing portals grants nothing the integration consumes and violates least privilege. It tempts because broad admin credentials do let many tools enumerate accounts, but CSPM only needs read APIs.

Installation of a hardware security module (HSM) appliance in every AWS region.

Why it fails: An HSM appliance provides FIPS 140-2 validated key storage and cryptographic operations, neither of which Prisma Cloud's CSPM onboarding consumes; the integration reads configuration metadata through a cross-account IAM role, not customer-managed keys. It would be the right choice when regulatory mandates require dedicated hardware key custody, such as signing certificate authorities or payment PIN translation.

Full root account password sharing stored in plaintext within Prisma Cloud configuration tables.

Why it fails: Storing root credentials in plaintext violates Prisma Cloud's onboarding model, which uses a cross-account IAM role with an external ID for read-only API access. Root password sharing grants unrestricted control and cannot be scoped or rotated. It would only fit legacy tools lacking role assumption, never a CSPM integration.

Flashing the Defender firmware directly onto the physical server BIOS/UEFI chip

Why it fails: Defenders are software agents installed on the host OS, not firmware; BIOS/UEFI flashing is unsupported. Flashing is tempting because it suggests deep host-level installation, but Defender runs as a process or container on Linux, so writing to firmware cannot deploy it and would damage the server.

Manually compiling the Defender source code from C++ GitHub repositories

Why it fails: Defenders are distributed as prebuilt binaries, containers, or installers; no supported workflow compiles Defender source from GitHub. Compiling is tempting because open-source security agents sometimes ship source, but Prisma Cloud Compute provides packaged deployment artefacts, and building from C++ repositories is neither documented nor supported.

Real-time kernel-level packet inspection for container network interfaces.

Why it fails: CEM evaluates effective permissions and unused entitlements for cloud identities; kernel-level packet inspection belongs to container runtime defence, not entitlement analysis. It is tempting because Prisma Cloud includes workload protection, and would be correct for detecting network-level threats inside container interfaces.

Automated blocking of SQL injection attacks on web applications.

Why it fails: CEM analyses identity permissions and entitlement risk across cloud accounts; blocking SQL injection is a web application firewall function, unrelated to identity entitlements. It is tempting because Prisma Cloud offers that protection elsewhere, and would be correct for defending internet-facing applications against injection payloads.

Host vulnerability scanning for operating system packages.

Why it fails: Host vulnerability scanning covers OS packages on compute instances, whereas Cloud Entitlement Management analyses identity permissions, unused access and privilege escalation across cloud platforms. It is tempting because Prisma Cloud does offer host scanning, but that belongs to Compute Compliance, not the identity-focused CEM module this question targets.

Upgrading the cloud provider account tier from Free to Enterprise.

Why it fails: Upgrading a cloud provider account tier is a commercial change made in the provider console, not an action available on a Prisma Cloud alert. It is tempting because licensing affects feature availability, but the Alerts tab exposes triage operations such as resolve, dismiss, snooze, and policy-based actions, not account subscription management.

Permanently deleting the cloud provider virtual machine associated with the alert.

Why it fails: Permanently deleting the associated virtual machine is a destructive provider-side operation, not an alert action within Prisma Cloud. It is tempting because alerts name affected resources, but the Alerts tab offers triage actions like resolve, dismiss, and snooze; remediation of the resource itself is handled through separate playbooks or the provider console.

Rewriting the cloud provider's regional datacenter routing tables.

Why it fails: Rewriting cloud provider regional datacenter routing tables is infrastructure administration performed outside Prisma Cloud, not an alert action. It is tempting because alerts can reference affected regions, but the Alerts tab only supports triage actions such as resolving, dismissing, or snoozing alerts, not provider-side network reconfiguration.

Manage AWS IAM user credentials and rotate access keys automatically.

Why it fails: Host Defender inspects the filesystem, processes and packages on the Linux VM; it does not integrate with the AWS IAM service to create or rotate access keys. It is tempting because Prisma Cloud covers identity risk, and credential rotation would be correct for a cloud IAM governance capability rather than a host agent.

Act as a Kubernetes Ingress controller terminating TLS connections for microservices.

Why it fails: Host Defender is a host-based agent performing runtime defence, compliance checks and vulnerability assessment on the VM; it does not proxy network traffic or terminate TLS, which is an ingress-layer function. It is tempting because Prisma Cloud secures container workloads, and an ingress controller would be correct for exposing microservices.

Automatically provision new AWS EC2 instances via Terraform when cluster load increases.

Why it fails: Host Defender runs inside the guest OS and reports findings; it holds no AWS control-plane permissions to call EC2 APIs or execute Terraform, so it cannot provision instances. It is tempting because Prisma Cloud offers cloud security posture management, and auto-scaling provisioning would be correct for a control-plane automation tool.

Local Linux OS user accounts and SSH public keys

Why it fails: Account Groups in Prisma Cloud aggregate cloud accounts for policy scoping and inheritance; they hold no host-level credentials such as Linux users or SSH keys. It is tempting because host configuration exists in Prisma Cloud Compute, but that is managed through host policies, not Account Group settings.

Specific cloud regions or resource types

Why it fails: Account Groups scope by cloud account membership, not by region or resource type; those filters belong to policies, alert rules or saved searches. It is tempting because narrowing scope by region feels like grouping, but Account Groups contain accounts, and region-level targeting is applied when a policy is evaluated.

Roll back the Kubernetes deployment to the previous stable Helm chart version.

Why it fails: Prisma Cloud runtime rules act on the running container or host, blocking processes, killing containers, or isolating workloads; they do not manage Helm release history or Kubernetes rollbacks. Rollback is a deployment-pipeline action, not a runtime enforcement response.

Automatically patch the container image vulnerability in the private registry.

Why it fails: Runtime rules observe running containers and cannot rebuild or repush images to a registry; vulnerability remediation happens in the CI/CD pipeline or registry scanning workflow. Patching images is a build-time activity, distinct from runtime blocking or alerting.